@quonfig/cli 0.0.22 → 0.0.23

package/README.md

@@ -14,7 +14,7 @@ $ npm install -g @quonfig/cli
 $ qfg COMMAND
 running command...
 $ qfg (--version)
-@quonfig/cli/0.0.22 linux-x64 node-v24.4.1
+@quonfig/cli/0.0.23 linux-x64 node-v24.4.1
 $ qfg --help [COMMAND]
 USAGE
   $ qfg COMMAND
@@ -92,7 +92,7 @@ EXAMPLES
   $ qfg config-schema --json-schema    # full JSON Schema document (copy into your editor)
 ```
 
-_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/config-schema.ts)_
+_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/config-schema.ts)_
 
 ## `qfg create NAME`
 
@@ -177,7 +177,7 @@ EXAMPLES
   $ qfg set-rollout my.new.flag --environment production --true-percent 20
 ```
 
-_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/create.ts)_
+_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/create.ts)_
 
 ## `qfg delete NAME`
 
@@ -223,7 +223,7 @@ EXAMPLES
   $ qfg delete my.config --yes
 ```
 
-_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/delete.ts)_
+_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/delete.ts)_
 
 ## `qfg flag info [NAME]`
 
@@ -426,7 +426,7 @@ EXAMPLES
   $ qfg generate --targets node-ts -o ./dist # combine with targets
 ```
 
-_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/generate.ts)_
+_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/generate.ts)_
 
 ## `qfg generate-new-hex-key`
 
@@ -449,7 +449,7 @@ EXAMPLES
   $ qfg generate-new-hex-key
 ```
 
-_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/generate-new-hex-key.ts)_
+_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/generate-new-hex-key.ts)_
 
 ## `qfg get [NAME]`
 
@@ -481,7 +481,7 @@ EXAMPLES
   $ qfg get my.config.name --environment=production
 ```
 
-_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/get.ts)_
+_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/get.ts)_
 
 ## `qfg info [NAME]`
 
@@ -529,7 +529,7 @@ EXAMPLES
   $ qfg info my.config.name --exclude-evaluations   # skip 24h stats
 ```
 
-_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/info.ts)_
+_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/info.ts)_
 
 ## `qfg init [DIRECTORY]`
 
@@ -569,7 +569,7 @@ EXAMPLES
   $ qfg init --dry-run
 ```
 
-_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/init.ts)_
+_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/init.ts)_
 
 ## `qfg interactive`
 
@@ -599,7 +599,7 @@ EXAMPLES
   $ qfg
 ```
 
-_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/interactive.ts)_
+_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/interactive.ts)_
 
 ## `qfg list`
 
@@ -639,7 +639,7 @@ EXAMPLES
   $ qfg list --feature-flags
 ```
 
-_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/list.ts)_
+_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/list.ts)_
 
 ## `qfg log-level NAME`
 
@@ -704,7 +704,7 @@ EXAMPLES
   $ qfg log-level log-level.my-app --target=Chatty --value=INFO --environment=production
 ```
 
-_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/log-level.ts)_
+_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/log-level.ts)_
 
 ## `qfg login`
 
@@ -729,7 +729,7 @@ EXAMPLES
   $ qfg login --profile myprofile
 ```
 
-_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/login.ts)_
+_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/login.ts)_
 
 ## `qfg logout`
 
@@ -752,7 +752,7 @@ EXAMPLES
   $ qfg logout
 ```
 
-_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/logout.ts)_
+_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/logout.ts)_
 
 ## `qfg mcp`
 
@@ -785,7 +785,7 @@ EXAMPLES
   $ qfg mcp --url http://local-app.quonfig-staging.com:3003/api/v1/mcp
 ```
 
-_See code: [src/commands/mcp.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/mcp.ts)_
+_See code: [src/commands/mcp.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/mcp.ts)_
 
 ## `qfg migrate`
 
@@ -839,7 +839,7 @@ EXAMPLES
   $ qfg migrate --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-config --staging
 ```
 
-_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/migrate.ts)_
+_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/migrate.ts)_
 
 ## `qfg migrate doctor`
 
@@ -877,7 +877,7 @@ EXAMPLES
   $ qfg migrate doctor --json
 ```
 
-_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/migrate/doctor.ts)_
+_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/migrate/doctor.ts)_
 
 ## `qfg migrate my-code`
 
@@ -909,7 +909,7 @@ EXAMPLES
   $ qfg migrate my-code --dry-run
 ```
 
-_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/migrate/my-code.ts)_
+_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/migrate/my-code.ts)_
 
 ## `qfg migrate status`
 
@@ -940,7 +940,7 @@ EXAMPLES
   $ qfg migrate status --json
 ```
 
-_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/migrate/status.ts)_
+_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/migrate/status.ts)_
 
 ## `qfg override [NAME] [VALUE]`
 
@@ -995,7 +995,7 @@ EXAMPLES
   $ qfg override my.flag true --env=staging
 ```
 
-_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/override.ts)_
+_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/override.ts)_
 
 ## `qfg pull`
 
@@ -1039,7 +1039,7 @@ EXAMPLES
   $ qfg pull  # uses QUONFIG_DIR env var
 ```
 
-_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/pull.ts)_
+_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/pull.ts)_
 
 ## `qfg push`
 
@@ -1087,7 +1087,7 @@ EXAMPLES
   $ qfg push --dir ./our-config --yes
 ```
 
-_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/push.ts)_
+_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/push.ts)_
 
 ## `qfg schema NAME`
 
@@ -1125,7 +1125,7 @@ EXAMPLES
   $ qfg schema my-schema --set-json-schema=@schemas/my-schema.json --protected
 ```
 
-_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/schema.ts)_
+_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/schema.ts)_
 
 ## `qfg sdk-key`
 
@@ -1152,7 +1152,7 @@ EXAMPLES
   $ qfg sdk-key revoke <key-id>
 ```
 
-_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/sdk-key.ts)_
+_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/sdk-key.ts)_
 
 ## `qfg sdk-key create`
 
@@ -1184,7 +1184,7 @@ EXAMPLES
   $ qfg sdk-key create --environment staging --type browser
 ```
 
-_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/sdk-key/create.ts)_
+_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/sdk-key/create.ts)_
 
 ## `qfg sdk-key list`
 
@@ -1213,7 +1213,7 @@ EXAMPLES
   $ qfg sdk-key list --environment production
 ```
 
-_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/sdk-key/list.ts)_
+_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/sdk-key/list.ts)_
 
 ## `qfg sdk-key revoke KEYID`
 
@@ -1240,7 +1240,7 @@ EXAMPLES
   $ qfg sdk-key revoke a1b2c3d4-e5f6-7890-abcd-ef1234567890
 ```
 
-_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/sdk-key/revoke.ts)_
+_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/sdk-key/revoke.ts)_
 
 ## `qfg set-default [NAME]`
 
@@ -1311,7 +1311,7 @@ EXAMPLES
   $ qfg pull && qfg config-schema
 ```
 
-_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/set-default.ts)_
+_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/set-default.ts)_
 
 ## `qfg set-rollout [NAME]`
 
@@ -1388,7 +1388,7 @@ EXAMPLES
   $ qfg set-rollout my.variant.flag --environment production --weights "a:33,b:33,c:34" --hash-by user.id
 ```
 
-_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/set-rollout.ts)_
+_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/set-rollout.ts)_
 
 ## `qfg sync`
 
@@ -1420,7 +1420,7 @@ EXAMPLES
   $ qfg sync --watch --dir ./our-config --interval 30
 ```
 
-_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/sync.ts)_
+_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/sync.ts)_
 
 ## `qfg toggle [NAME]`
 
@@ -1522,7 +1522,7 @@ EXAMPLES
   $ qfg verify --json
 ```
 
-_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/verify.ts)_
+_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/verify.ts)_
 
 ## `qfg whoami`
 
@@ -1545,7 +1545,7 @@ EXAMPLES
   $ qfg whoami
 ```
 
-_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/whoami.ts)_
+_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/whoami.ts)_
 
 ## `qfg workspace`
 
@@ -1568,7 +1568,7 @@ EXAMPLES
   $ qfg workspace
 ```
 
-_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/workspace.ts)_
+_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/workspace.ts)_
 
 ## `qfg workspace bootstrap`
 
@@ -1601,7 +1601,7 @@ EXAMPLES
   $ qfg workspace bootstrap --dir ./our-config --skip-validate
 ```
 
-_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/workspace/bootstrap.ts)_
+_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/workspace/bootstrap.ts)_
 
 ## `qfg workspace create SLUG`
 
@@ -1635,7 +1635,7 @@ EXAMPLES
   $ qfg workspace create my-team --org 11111111-1111-1111-1111-111111111111
 ```
 
-_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/workspace/create.ts)_
+_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/workspace/create.ts)_
 
 ## `qfg workspace switch [SLUG]`
 
@@ -1663,7 +1663,7 @@ EXAMPLES
   $ qfg workspace switch my-workspace-slug
 ```
 
-_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.22/src/commands/workspace/switch.ts)_
+_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.23/src/commands/workspace/switch.ts)_
 <!-- commandsstop -->
 
 ## Local Development

package/dist/commands/pull.js

@@ -186,9 +186,9 @@ CLI shortcuts (no JSON editing needed for simple cases):
     async maybeWriteQuonfigDir(dir) {
         if (process.env.QUONFIG_DIR)
             return; // already set via env
-        const os = await import('node:os');
         const pathMod = await import('node:path');
-        const configFilePath = pathMod.join(os.homedir(), '.quonfig', 'config');
+        const { getQuonfigConfigHome } = await import('../util/quonfig-home.js');
+        const configFilePath = pathMod.join(getQuonfigConfigHome(), 'config');
         try {
             const existing = await fs.promises.readFile(configFilePath, 'utf8').catch(() => '');
             if (existing.includes('QUONFIG_DIR') || existing.includes('quonfig_dir'))

package/dist/commands/push.d.ts

@@ -1,8 +1,7 @@
 import type { JsonObj } from '../result.js';
 import { BaseCommand } from '../index.js';
 import { GiteaTokenResponse } from '../util/gitea-api.js';
-import type { GiteaTokenMintResult } from '../push/run-push.js';
-import { runPush } from '../push/run-push.js';
+import { runPush, type GiteaTokenMintResult } from '../push/run-push.js';
 export default class Push extends BaseCommand {
     static description: string;
     static examples: string[];
@@ -34,20 +33,13 @@ export declare function giteaResponseToMintResult(resp: GiteaTokenResponse): Git
  *
  * Returns a `{deps, cleanup}` pair. The caller MUST call `cleanup()` in a
  * finally block so the bare-path probe clone is removed even on errors.
+ *
+ * As of qfg-azk.13 the push code path no longer mints a write-scoped Gitea
+ * token; the actual commit is performed server-side by the `configs.push`
+ * oRPC procedure. We still mint a READ token to authenticate the bare-path
+ * probe-clone and the clone-path `git fetch`.
  */
 export declare function buildRealDeps(cmd: Push): {
     deps: Parameters<typeof runPush>[1];
     cleanup: () => Promise<void>;
 };
-/**
- * Copy the contents of `sourceDir` into `destDir`, skipping `.git/` and any
- * temp push-clone scratch directories. Used as the `applyDelta` callback for
- * bare-path pushes — we mirror local files into a fresh clone so that
- * `cloneAndStackPush`'s `git add --all` + diff will reflect the union of
- * (deletes, modifies, adds) we intend.
- *
- * IMPORTANT: this deletes files in destDir that are not in sourceDir so that
- * deletions make it into the push. Without this the clone-and-stack produces
- * an "adds-only" delta and destructive heuristics would never fire in the UI.
- */
-export declare function copyDirMirror(sourceDir: string, destDir: string): Promise<void>;

package/dist/commands/push.js

@@ -5,9 +5,10 @@ import * as util from 'node:util';
 import { Flags } from '@oclif/core';
 import { BaseCommand } from '../index.js';
 import { mintGiteaToken } from '../util/gitea-api.js';
-import { getRemoteUrl, gitFetch, gitSetRemote, isGitRepo, } from '../util/git-ops.js';
-import { PushFatalError, runPush } from '../push/run-push.js';
+import { getRemoteUrl, gitFetch, gitSetRemote, isGitRepo } from '../util/git-ops.js';
+import { PushFatalError, runPush, } from '../push/run-push.js';
 import { computeBarePathDiff } from '../push/bare-path-diff.js';
+import { callConfigsPush } from '../push/config-push-client.js';
 import { resolveWorkspaceUuid } from '../util/resolve-workspace.js';
 const execFile = util.promisify(execFileCb);
 export default class Push extends BaseCommand {
@@ -127,6 +128,11 @@ export function giteaResponseToMintResult(resp) {
  *
  * Returns a `{deps, cleanup}` pair. The caller MUST call `cleanup()` in a
  * finally block so the bare-path probe clone is removed even on errors.
+ *
+ * As of qfg-azk.13 the push code path no longer mints a write-scoped Gitea
+ * token; the actual commit is performed server-side by the `configs.push`
+ * oRPC procedure. We still mint a READ token to authenticate the bare-path
+ * probe-clone and the clone-path `git fetch`.
  */
 export function buildRealDeps(cmd) {
     const log = (line) => cmd.log(line);
@@ -187,12 +193,6 @@ export function buildRealDeps(cmd) {
             const probe = await ensureBarePathProbe(dir);
             return probe.deltas;
         },
-        async push(dir) {
-            await execFile('git', ['-C', dir, 'push', 'origin', 'main']);
-        },
-        async getLocalAuthor(dir) {
-            return readLocalAuthor(dir);
-        },
         async countFilesInRemote(dir) {
             if (await isGitRepo(dir)) {
                 const fromGit = await countTrackedFilesAtRef(dir, 'origin/main');
@@ -207,9 +207,11 @@ export function buildRealDeps(cmd) {
     };
     const deps = {
         async mintWriteToken(requestedTarget) {
-            const resp = await mintGiteaToken(requestedTarget, 'write', 'push');
-            // Stash the authenticated URL so the bare-path gitOps methods can
-            // probe-clone it without a second mint.
+            // Read scope: this token authenticates probe-clone and clone-path
+            // fetch. The actual commit goes through the server via configs.push,
+            // which is authorized off the user's WorkOS session — no write PAT
+            // needed in the push code path (qfg-azk.13).
+            const resp = await mintGiteaToken(requestedTarget, 'read', 'pull');
             authenticatedRepoUrl = resp.repoUrl;
             return giteaResponseToMintResult(resp);
         },
@@ -220,7 +222,7 @@ export function buildRealDeps(cmd) {
             return { errors };
         },
         gitOps,
-        copyDirMirror,
+        pushToServer: callConfigsPush,
         log,
         errLog,
     };
@@ -237,26 +239,20 @@ export function buildRealDeps(cmd) {
     return { deps, cleanup };
 }
 /**
- * Diff the working tree (what we are about to push) against origin/main. We
- * use `git diff --name-status HEAD..origin/main` with inverted semantics:
- *   Added here  = present locally (in HEAD), absent in origin/main.
- *   Deleted     = absent locally, present in origin/main.
- *   Modified    = content differs.
+ * Diff the working tree (what we are about to push) against origin/main and
+ * fill in before/after JSON content for each delta as required by the
+ * `configs.push` wire shape (qfg-azk.13).
+ *
+ *   Added    — afterJson = working tree
+ *   Modified — beforeJson = `git show origin/main:<path>`, afterJson = working tree
+ *   Deleted  — beforeJson = `git show origin/main:<path>`
  *
  * `git diff A..B` reports B relative to A. So `HEAD..origin/main` tells us
  * what origin has that we don't. We want "local vs remote" with local as the
  * baseline — i.e. origin/main..HEAD.
  */
 async function diffHeadVsOrigin(dir) {
-    // origin/main..HEAD reports changes HEAD has relative to origin/main.
-    // 'A' -> added locally, 'D' -> deleted locally, 'M' -> modified locally.
-    const { stdout } = await execFile('git', [
-        '-C',
-        dir,
-        'diff',
-        '--name-status',
-        'origin/main..HEAD',
-    ]);
+    const { stdout } = await execFile('git', ['-C', dir, 'diff', '--name-status', 'origin/main..HEAD']);
     const deltas = [];
     for (const raw of stdout.split('\n')) {
         const line = raw.trim();
@@ -266,95 +262,54 @@ async function diffHeadVsOrigin(dir) {
         const pathStr = rest.join(' ');
         if (!pathStr)
             continue;
-        if (status.startsWith('A'))
-            deltas.push({ kind: 'added', path: pathStr });
-        else if (status.startsWith('D'))
-            deltas.push({ kind: 'deleted', path: pathStr });
+        if (status.startsWith('A')) {
+            // eslint-disable-next-line no-await-in-loop
+            const afterJson = await readWorkingTreeFile(dir, pathStr);
+            deltas.push({ kind: 'added', path: pathStr, ...(afterJson === undefined ? {} : { afterJson }) });
+        }
+        else if (status.startsWith('D')) {
+            // eslint-disable-next-line no-await-in-loop
+            const beforeJson = await showAtRef(dir, 'origin/main', pathStr);
+            deltas.push({ kind: 'deleted', path: pathStr, ...(beforeJson === undefined ? {} : { beforeJson }) });
+        }
         else if (status.startsWith('M') || status.startsWith('R') || status.startsWith('C')) {
-            // Treat renames / copies as modifications for diff-summary purposes.
-            deltas.push({ kind: 'modified', path: pathStr });
+            // eslint-disable-next-line no-await-in-loop
+            const beforeJson = await showAtRef(dir, 'origin/main', pathStr);
+            // eslint-disable-next-line no-await-in-loop
+            const afterJson = await readWorkingTreeFile(dir, pathStr);
+            deltas.push({
+                kind: 'modified',
+                path: pathStr,
+                ...(beforeJson === undefined ? {} : { beforeJson }),
+                ...(afterJson === undefined ? {} : { afterJson }),
+            });
         }
     }
     return deltas;
 }
-async function countTrackedFilesAtRef(dir, ref) {
+async function showAtRef(dir, ref, relPath) {
     try {
-        const { stdout } = await execFile('git', ['-C', dir, 'ls-tree', '-r', '--name-only', ref]);
-        return stdout.split('\n').filter((l) => l.trim().length > 0).length;
+        const { stdout } = await execFile('git', ['-C', dir, 'show', `${ref}:${relPath}`]);
+        return stdout;
     }
     catch {
-        return 0;
+        return undefined;
     }
 }
-async function readLocalAuthor(dir) {
+async function readWorkingTreeFile(dir, relPath) {
     try {
-        const { stdout: name } = await execFile('git', ['-C', dir, 'config', 'user.name']);
-        const { stdout: email } = await execFile('git', ['-C', dir, 'config', 'user.email']);
-        const n = name.trim();
-        const e = email.trim();
-        if (!n || !e)
-            return undefined;
-        return { name: n, email: e };
+        return await fs.promises.readFile(path.join(dir, relPath), 'utf8');
     }
     catch {
         return undefined;
     }
 }
-/**
- * Copy the contents of `sourceDir` into `destDir`, skipping `.git/` and any
- * temp push-clone scratch directories. Used as the `applyDelta` callback for
- * bare-path pushes — we mirror local files into a fresh clone so that
- * `cloneAndStackPush`'s `git add --all` + diff will reflect the union of
- * (deletes, modifies, adds) we intend.
- *
- * IMPORTANT: this deletes files in destDir that are not in sourceDir so that
- * deletions make it into the push. Without this the clone-and-stack produces
- * an "adds-only" delta and destructive heuristics would never fire in the UI.
- */
-export async function copyDirMirror(sourceDir, destDir) {
-    // Collect source entries (except .git, .quonfig-push-clone-*)
-    const sourceRel = collectRelPaths(sourceDir);
-    const destRel = collectRelPaths(destDir);
-    // Delete anything in dest that isn't in source
-    for (const rel of destRel) {
-        if (!sourceRel.has(rel)) {
-            const full = path.join(destDir, rel);
-            try {
-                fs.rmSync(full, { force: true });
-            }
-            catch {
-                /* ignore */
-            }
-        }
+async function countTrackedFilesAtRef(dir, ref) {
+    try {
+        const { stdout } = await execFile('git', ['-C', dir, 'ls-tree', '-r', '--name-only', ref]);
+        return stdout.split('\n').filter((l) => l.trim().length > 0).length;
     }
-    // Copy / overwrite everything from source into dest
-    for (const rel of sourceRel) {
-        const src = path.join(sourceDir, rel);
-        const dst = path.join(destDir, rel);
-        fs.mkdirSync(path.dirname(dst), { recursive: true });
-        fs.copyFileSync(src, dst);
+    catch {
+        return 0;
     }
 }
-function collectRelPaths(root) {
-    const out = new Set();
-    if (!fs.existsSync(root))
-        return out;
-    const walk = (dir, prefix) => {
-        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-            if (entry.name === '.git')
-                continue;
-            if (entry.name.startsWith('.quonfig-push-clone-'))
-                continue;
-            const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
-            const full = path.join(dir, entry.name);
-            if (entry.isDirectory()) {
-                walk(full, rel);
-            }
-            else if (entry.isFile() || entry.isSymbolicLink()) {
-                out.add(rel);
-            }
-        }
-    };
-    walk(root, '');
-    return out;
-}

package/dist/init/schema.js

@@ -298,8 +298,10 @@ export function storedConfigJsonSchema() {
                 type: 'string',
                 description: 'References a schema in schemas/ or schemas-protected/. The referenced file must exist.',
             },
-            accessLevel: { type: 'string' },
-            protection: { type: 'string' },
+            access: {
+                enum: ['support', 'standard', 'protected-env', 'protected-all-envs'],
+                description: 'Edit-access tier for this config. Defaults to "standard" when absent. See protecting-access.md.',
+            },
             tags: {
                 type: 'array',
                 items: { type: 'string' },

package/dist/push/bare-path-diff.js

@@ -54,35 +54,37 @@ export async function computeBarePathDiff(localDir, remoteUrl) {
         }
         throw error;
     }
-    const localFiles = collectFilesWithHash(localDir);
-    const remoteFiles = collectFilesWithHash(scratchDir);
+    const localFiles = collectFiles(localDir);
+    const remoteFiles = collectFiles(scratchDir);
     const deltas = [];
-    for (const [rel, localHash] of localFiles) {
-        const remoteHash = remoteFiles.get(rel);
-        if (remoteHash === undefined) {
-            deltas.push({ kind: 'added', path: rel });
+    for (const [rel, local] of localFiles) {
+        const remote = remoteFiles.get(rel);
+        if (remote === undefined) {
+            deltas.push({ kind: 'added', path: rel, afterJson: local.content });
         }
-        else if (remoteHash !== localHash) {
-            deltas.push({ kind: 'modified', path: rel });
+        else if (remote.hash !== local.hash) {
+            deltas.push({ kind: 'modified', path: rel, beforeJson: remote.content, afterJson: local.content });
         }
     }
-    for (const rel of remoteFiles.keys()) {
+    for (const [rel, remote] of remoteFiles) {
         if (!localFiles.has(rel)) {
-            deltas.push({ kind: 'deleted', path: rel });
+            deltas.push({ kind: 'deleted', path: rel, beforeJson: remote.content });
         }
     }
     return { deltas, scratchDir, totalRemoteFiles: remoteFiles.size };
 }
 /**
- * Walk `root` and return a map of relative-path -> content-hash for every
- * non-dotfile file under it.
+ * Walk `root` and return a map of relative-path -> {content, hash} for every
+ * non-dotfile file under it. The content string is needed by qfg-azk.13's
+ * `configs.push` wire shape; the hash is used to short-circuit the
+ * unchanged-file case without comparing full bodies.
  *
  * We skip any entry whose name starts with a `.`, which covers `.git/`,
  * `.DS_Store`, and the transient `.quonfig-push-clone-*` scratch dirs that
  * `run-push.ts` creates next to the local workspace. Keeping the rule simple
  * and symmetric on both sides prevents one-off false positives.
  */
-function collectFilesWithHash(root) {
+function collectFiles(root) {
     const out = new Map();
     if (!fs.existsSync(root))
         return out;
@@ -104,8 +106,8 @@ function collectFilesWithHash(root) {
             }
             else if (entry.isFile() || entry.isSymbolicLink()) {
                 try {
-                    const buf = fs.readFileSync(full);
-                    out.set(rel, hashBytes(buf));
+                    const content = fs.readFileSync(full, 'utf8');
+                    out.set(rel, { content, hash: hashString(content) });
                 }
                 catch {
                     /* ignore unreadable files — they won't appear on either side */
@@ -121,6 +123,6 @@ function collectFilesWithHash(root) {
  * fingerprint so we can say "file A on local matches file A on remote". The
  * contents are small JSON in practice, so sha1 is plenty fast.
  */
-function hashBytes(buf) {
-    return createHash('sha1').update(buf).digest('hex');
+function hashString(s) {
+    return createHash('sha1').update(s).digest('hex');
 }

package/dist/push/config-push-client.d.ts

@@ -0,0 +1,18 @@
+/**
+ * HTTP client for the `configs.push` oRPC procedure (qfg-azk.13).
+ *
+ * Server-side spec lives at
+ * `app-quonfig/src/lib/orpc/routes/config-push-handler.ts`. We translate the
+ * oRPC error shape into a tagged union the CLI can pattern-match on:
+ *
+ *   - 200 → `{kind: 'success', commitSha}`
+ *   - 403 with `data.denials` → `{kind: 'denied', denials}`
+ *   - 409 → `{kind: 'conflict', message}`
+ *   - 400 → `{kind: 'bad-request', message}`
+ *   - anything else → throws so runPush surfaces a generic PushFatalError.
+ *
+ * The auth header is a WorkOS access token (or a `qf_uk_*` API key when
+ * `QUONFIG_API_KEY` is set in the environment); see `getValidAccessToken`.
+ */
+import type { ConfigPushInput, ConfigPushResult } from './run-push.js';
+export declare const callConfigsPush: (input: ConfigPushInput) => Promise<ConfigPushResult>;

package/dist/push/config-push-client.js

@@ -0,0 +1,82 @@
+/**
+ * HTTP client for the `configs.push` oRPC procedure (qfg-azk.13).
+ *
+ * Server-side spec lives at
+ * `app-quonfig/src/lib/orpc/routes/config-push-handler.ts`. We translate the
+ * oRPC error shape into a tagged union the CLI can pattern-match on:
+ *
+ *   - 200 → `{kind: 'success', commitSha}`
+ *   - 403 with `data.denials` → `{kind: 'denied', denials}`
+ *   - 409 → `{kind: 'conflict', message}`
+ *   - 400 → `{kind: 'bad-request', message}`
+ *   - anything else → throws so runPush surfaces a generic PushFatalError.
+ *
+ * The auth header is a WorkOS access token (or a `qf_uk_*` API key when
+ * `QUONFIG_API_KEY` is set in the environment); see `getValidAccessToken`.
+ */
+import { getApiUrl } from '../util/domain-urls.js';
+import { getValidAccessToken } from '../util/get-valid-token.js';
+export const callConfigsPush = async (input) => {
+    const accessToken = await getValidAccessToken();
+    const apiUrl = getApiUrl();
+    const res = await fetch(`${apiUrl}/api/v1/configs/push`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ json: input }),
+    });
+    if (res.ok) {
+        const body = (await res.json());
+        const commitSha = body.json?.commitSha;
+        if (!commitSha) {
+            throw new Error(`configs.push returned 200 but no commitSha (body=${JSON.stringify(body)})`);
+        }
+        return { kind: 'success', commitSha };
+    }
+    const text = await res.text().catch(() => '');
+    let parsed;
+    try {
+        const body = JSON.parse(text);
+        parsed = body.json ?? body;
+    }
+    catch {
+        /* keep parsed undefined */
+    }
+    const message = parsed?.message ?? text ?? `HTTP ${res.status}`;
+    if (res.status === 403) {
+        const denials = extractDenials(parsed?.data);
+        if (denials.length > 0) {
+            return { kind: 'denied', denials };
+        }
+    }
+    if (res.status === 409) {
+        return { kind: 'conflict', message };
+    }
+    if (res.status === 400) {
+        return { kind: 'bad-request', message };
+    }
+    throw new Error(`configs.push failed (HTTP ${res.status}): ${message}`);
+};
+function extractDenials(data) {
+    if (!data || typeof data !== 'object')
+        return [];
+    const denials = data.denials;
+    if (!Array.isArray(denials))
+        return [];
+    const out = [];
+    for (const raw of denials) {
+        if (!raw || typeof raw !== 'object')
+            continue;
+        const r = raw;
+        if (typeof r.path !== 'string' || typeof r.requiredPermission !== 'string')
+            continue;
+        out.push({
+            path: r.path,
+            reason: typeof r.reason === 'string' ? r.reason : `Missing required permission: ${r.requiredPermission}`,
+            requiredPermission: r.requiredPermission,
+        });
+    }
+    return out;
+}

package/dist/push/diff-summary.d.ts

@@ -14,6 +14,17 @@
  */
 /** A single file-level change between the local working tree and remote HEAD. */
 export interface FileDelta {
+    /**
+     * Local content for `added`/`modified`. Absent for `deleted`. Required by
+     * the `configs.push` server endpoint when sending the delta over the wire.
+     */
+    afterJson?: string;
+    /**
+     * Remote content for `modified`/`deleted`. Absent for `added`. Required by
+     * the `configs.push` server endpoint to deep-diff per-environment rule
+     * changes for authorization.
+     */
+    beforeJson?: string;
     /**
      * `added`    — present locally, absent on remote
      * `modified` — present in both, content differs

package/dist/push/diff-summary.js

@@ -16,14 +16,7 @@
  * Top-level directories we present as named rows. Anything else funnels into
  * `other`. Keeping this closed-set avoids one-off typos silently looking fine.
  */
-const KNOWN_GROUPS = [
-    'configs',
-    'feature-flags',
-    'segments',
-    'schemas',
-    'schemas-protected',
-    'log-levels',
-];
+const KNOWN_GROUPS = ['configs', 'feature-flags', 'segments', 'schemas', 'schemas-protected', 'log-levels'];
 const DESTRUCTIVE_DELETE_COUNT = 10;
 const DESTRUCTIVE_DELETE_RATIO = 0.25;
 function emptyCounts() {

package/dist/push/run-push.d.ts

@@ -18,7 +18,6 @@
  * `--yes` skips the normal Y/N confirmation. It NEVER skips a typed-slug
  * confirmation — that prompt is the destructive-change brake.
  */
-import { PushIdentity } from '../util/clone-and-stack-push.js';
 import { FileDelta } from './diff-summary.js';
 export interface GiteaTokenMintResult {
     expiresAt: string | null;
@@ -32,23 +31,52 @@ export interface GitOps {
     countFilesInRemote(dir: string): Promise<number>;
     /**
      * Produce the list of file deltas to render in the Guard 3 summary and
-     * (for the bare path) commit. For the clone path this is HEAD vs origin/main.
-     * For the bare path the caller hands us the deltas itself.
+     * send to the server. Each delta carries before/after JSON content per
+     * the `configs.push` wire shape (qfg-azk.13). For the clone path this is
+     * HEAD vs origin/main; for the bare path it's local vs probe-clone.
      */
     diffHeadVsOrigin(dir: string): Promise<FileDelta[]>;
     /** `git fetch origin` in the given dir. */
     fetch(dir: string): Promise<void>;
-    /** Read local git config for author identity (used for bare-path commits). */
-    getLocalAuthor(dir: string): Promise<PushIdentity | undefined>;
     /** Returns the `remote.origin.url` for the repo, or undefined if unset / not a repo. */
     getRemoteOriginUrl(dir: string): Promise<string | undefined>;
     /** Returns true if the dir has a `.git/` (worktree or repo). */
     isGitRepo(dir: string): Promise<boolean>;
-    /** `git push origin main`. Throws with a PushConflict-ish message on non-ff. */
-    push(dir: string): Promise<void>;
     /** Set origin to `url` (add if missing, set-url if present). */
     setRemoteOrigin(dir: string, url: string): Promise<void>;
 }
+/** Server-side `kind` enum (matches `FileDeltaSchema` in app-quonfig). */
+export type ServerFileKind = 'add' | 'delete' | 'modify';
+export interface ServerFileDelta {
+    afterJson?: string;
+    beforeJson?: string;
+    kind: ServerFileKind;
+    path: string;
+}
+export interface ConfigPushInput {
+    expectedSha?: string;
+    files: ServerFileDelta[];
+    message?: string;
+    workspaceId: string;
+}
+export type ConfigPushResult = {
+    kind: 'bad-request';
+    message: string;
+} | {
+    kind: 'conflict';
+    message: string;
+} | {
+    commitSha: string;
+    kind: 'success';
+} | {
+    denials: PushDenial[];
+    kind: 'denied';
+};
+export interface PushDenial {
+    path: string;
+    reason: string;
+    requiredPermission: string;
+}
 export type ConfirmIO = {
     input?: NodeJS.ReadableStream;
     output?: NodeJS.WritableStream;
@@ -70,18 +98,30 @@ export interface RunPushInput {
 export interface RunPushDeps {
     /** Optional io streams for confirmation prompts. Defaults to process stdin/stdout. */
     confirmIO?: ConfirmIO;
-    /**
-     * Copy files from `sourceDir` into `destDir`, skipping `.git/`. Used by the
-     * bare path as the `applyDelta` callback handed to `cloneAndStackPush`.
-     */
-    copyDirMirror(sourceDir: string, destDir: string): Promise<void>;
     /** Error logger; defaults to console.error. */
     errLog?: (line: string) => void;
     gitOps: GitOps;
     /** Logger; defaults to console.log. */
     log?: (line: string) => void;
-    /** Mint a write token via the backend. */
+    /**
+     * Resolve the backend's identity for this workspace. Returns repoUrl,
+     * workspaceSlug, workspaceId — used by the identity check and (for
+     * read-only auth) by the bare-path probe-clone and clone-path fetch.
+     *
+     * Named `mintWriteToken` for historical reasons; as of qfg-azk.13 the
+     * push code path no longer mints a write-scoped Gitea token (server-side
+     * commit via `configs.push`), so the real implementation now mints a
+     * read-scope token. The name is preserved to keep the test harness shape
+     * stable across the qfg-azk.13 transition.
+     */
     mintWriteToken(requestedTarget: string): Promise<GiteaTokenMintResult>;
+    /**
+     * Call the server-side `configs.push` oRPC procedure. Returns a tagged
+     * union so callers can distinguish success / per-file denials / a stale
+     * expectedSha conflict / a path allow-list violation without parsing
+     * HTTP status codes.
+     */
+    pushToServer(input: ConfigPushInput): Promise<ConfigPushResult>;
     /** Run `qfg validate` semantics. Should throw on error. */
     validate(dir: string): Promise<{
         errors: string[];

package/dist/push/run-push.js

@@ -19,8 +19,6 @@
  * confirmation — that prompt is the destructive-change brake.
  */
 import * as fs from 'node:fs';
-import * as path from 'node:path';
-import { MIGRATOR_IDENTITY, cloneAndStackPush } from '../util/clone-and-stack-push.js';
 import { readWorkspaceSlug, writeWorkspaceSlug } from '../util/quonfig-json.js';
 import { checkIdentity } from './identity-check.js';
 import { confirmTypedSlug, confirmYesNo } from './confirm.js';
@@ -118,19 +116,18 @@ export async function runPush(input, deps) {
     // repo into a scratch dir inside `.quonfig-push-clone/` and stack a commit
     // that mirrors the local dir's contents on top.
     const isClonePath = hasGit && remoteOriginUrl !== undefined && sameRepo(remoteOriginUrl, backend.repoUrl);
+    const dispatchedAs = isClonePath ? 'clone-path' : 'bare-path';
+    // Clone path: align origin with the backend so the gitOps.fetch + diff
+    // walk authenticates against the read URL we minted. The bare path's
+    // probe-clone path bypasses local origin entirely.
     if (isClonePath) {
-        return doClonePath(input, deps, backend, requiresTypedSlug, repoPinSlug === undefined, log);
+        await deps.gitOps.setRemoteOrigin(input.dir, backend.repoUrl);
+        log('Fetching from remote...');
+        await deps.gitOps.fetch(input.dir);
     }
-    return doBarePath(input, deps, backend, requiresTypedSlug, repoPinSlug === undefined, log);
-}
-async function doClonePath(input, deps, backend, requiresTypedSlug, unpinned, log) {
-    // Point origin at the authenticated URL so `git fetch` / `git push` work
-    // without touching global credential helpers.
-    await deps.gitOps.setRemoteOrigin(input.dir, backend.repoUrl);
-    log('Fetching from remote...');
-    await deps.gitOps.fetch(input.dir);
     const deltas = await deps.gitOps.diffHeadVsOrigin(input.dir);
     const totalFilesInRemote = await deps.gitOps.countFilesInRemote(input.dir);
+    const unpinned = repoPinSlug === undefined;
     const summary = summarizeDiff(deltas, { totalFilesInRemote, unpinned });
     log('');
     log(summary.renderText({
@@ -140,7 +137,6 @@ async function doClonePath(input, deps, backend, requiresTypedSlug, unpinned, lo
         localDir: input.dir,
     }));
     log('');
-    // Short-circuit: literally nothing to push.
     if (summary.totals.filesTouched === 0) {
         return { kind: 'no-op', reason: 'Local tree matches remote HEAD. Nothing to push.' };
     }
@@ -155,141 +151,57 @@ async function doClonePath(input, deps, backend, requiresTypedSlug, unpinned, lo
         log('Aborted, nothing pushed.');
         return { kind: 'aborted', reason: 'user declined at confirm prompt' };
     }
-    log('Pushing to origin/main...');
-    try {
-        await deps.gitOps.push(input.dir);
-    }
-    catch (error) {
-        const msg = error instanceof Error ? error.message : String(error);
-        if (/non-fast-forward|fetch first|rejected/i.test(msg)) {
-            throw new PushFatalError('Remote has changes not in local — run `qfg pull` first, then re-run `qfg push`.', 'NON_FAST_FORWARD');
+    const baseMessage = input.message ?? `qfg push: ${summary.totals.filesTouched} file change(s)`;
+    const commitMessage = withPushedViaTrailer(baseMessage);
+    const serverFiles = deltas.map((d) => ({
+        path: d.path,
+        kind: toServerKind(d.kind),
+        ...(d.beforeJson === undefined ? {} : { beforeJson: d.beforeJson }),
+        ...(d.afterJson === undefined ? {} : { afterJson: d.afterJson }),
+    }));
+    log('Sending push to Quonfig cloud...');
+    const result = await deps.pushToServer({
+        workspaceId: backend.workspaceId,
+        files: serverFiles,
+        message: commitMessage,
+    });
+    if (result.kind === 'denied') {
+        errLog(`Push denied for ${result.denials.length} file(s):`);
+        for (const d of result.denials) {
+            errLog(`  ${d.path}: missing permission ${d.requiredPermission}`);
         }
-        throw new PushFatalError(`Push failed: ${msg}`, 'PUSH_FAILED');
+        throw new PushFatalError(`Push denied for ${result.denials.length} file(s). See errors above.`, 'PUSH_DENIED');
+    }
+    if (result.kind === 'conflict') {
+        throw new PushFatalError(`Remote moved while preparing this push (${result.message}). Run \`qfg pull\` and retry.`, 'CONFLICT');
+    }
+    if (result.kind === 'bad-request') {
+        throw new PushFatalError(`Push rejected by server: ${result.message}`, 'BAD_REQUEST');
     }
-    // Offer to pin the workspace slug in quonfig.json if missing. Non-fatal.
     if (unpinned && !input.noPinWrite) {
         try {
             await writeWorkspaceSlug(input.dir, backend.workspaceSlug);
             log(`Wrote workspace = "${backend.workspaceSlug}" into quonfig.json`);
         }
         catch {
-            // non-fatal; pin is advisory
+            /* non-fatal; pin is advisory */
         }
     }
-    return { kind: 'pushed', dispatchedAs: 'clone-path' };
+    return { kind: 'pushed', dispatchedAs, commitSha: result.commitSha };
 }
-async function doBarePath(input, deps, backend, requiresTypedSlug, unpinned, log) {
-    // Scratch clone location: sibling `.quonfig-push-clone-<timestamp>` so we
-    // don't clobber or re-use anything from a previous run.
-    const scratchDir = path.join(path.dirname(path.resolve(input.dir)), `.quonfig-push-clone-${Date.now()}`);
-    // Local author for the migrated commit. Prefer the local git config in
-    // `input.dir` so attribution matches what the user has set. If it is not
-    // available, fall back to the migrator identity but tell the user — the plan
-    // requires this be loud.
-    let author = MIGRATOR_IDENTITY;
-    try {
-        const local = await deps.gitOps.getLocalAuthor(input.dir);
-        if (local && local.name && local.email) {
-            author = local;
-        }
-        else {
-            log(`Warning: no local git user.name/user.email in ${input.dir}; commits will be attributed to ${MIGRATOR_IDENTITY.name} <${MIGRATOR_IDENTITY.email}>.`);
-        }
-    }
-    catch {
-        log(`Warning: could not read local git user identity; commits will be attributed to ${MIGRATOR_IDENTITY.name} <${MIGRATOR_IDENTITY.email}>.`);
-    }
-    // We need the deltas for the Guard 3 summary BEFORE we decide to commit and
-    // push. To produce them we need the scratch clone in hand (so we can compare
-    // file-by-file). We clone into the scratch dir, take the diff, show the
-    // summary, confirm, then apply the delta via `cloneAndStackPush`.
-    //
-    // Rather than re-implement cloneAndStackPush's clone step here, we let it
-    // own the clone-commit-push pipeline and pass a deltas callback that runs
-    // AFTER the clone (it receives the localDir/scratchDir) but BEFORE the
-    // commit. `cloneAndStackPush` only exposes an `applyDelta` hook (write files
-    // then return), so we split the flow: first a probe clone to take the
-    // diff, then the real clone-and-stack-push. This is simpler than rewiring
-    // cloneAndStackPush's API.
-    // Probe clone.
-    await deps.gitOps.fetch(input.dir) // no-op for bare path if not a repo; deps.gitOps may short-circuit
-        .catch(() => {
-        // bare-path doesn't require a local fetch — swallow the error
-    });
-    // We don't have a probe clone helper; instead, ask the deps for a bare-path
-    // delta computation. The test double will produce this from a fixture; the
-    // real implementation walks both trees after ensuring a scratch clone exists.
-    // This is provided by the command glue layer.
-    const deltas = await deps.gitOps.diffHeadVsOrigin(input.dir);
-    const totalFilesInRemote = await deps.gitOps.countFilesInRemote(input.dir);
-    const summary = summarizeDiff(deltas, { totalFilesInRemote, unpinned });
-    log('');
-    log(summary.renderText({
-        workspaceSlug: backend.workspaceSlug,
-        repoUrl: stripAuth(backend.repoUrl),
-        branch: 'main',
-        localDir: input.dir,
-    }));
-    log('');
-    if (summary.totals.filesTouched === 0) {
-        return { kind: 'no-op', reason: 'Local tree matches remote HEAD. Nothing to push.' };
-    }
-    const ok = await decideConfirm({
-        destructive: summary.isDestructive,
-        requiresTypedSlug,
-        yes: input.yes,
-        workspaceSlug: backend.workspaceSlug,
-        confirmIO: deps.confirmIO,
-    });
-    if (!ok) {
-        log('Aborted, nothing pushed.');
-        return { kind: 'aborted', reason: 'user declined at confirm prompt' };
-    }
-    const baseMessage = input.message ?? `qfg push: ${summary.totals.filesTouched} file change(s)`;
-    const commitMessage = withPushedViaTrailer(baseMessage);
-    log('Pushing via clone-and-stack...');
-    try {
-        const result = await cloneAndStackPush({
-            remoteUrl: backend.repoUrl,
-            localDir: scratchDir,
-            author,
-            commitMessage,
-            async applyDelta(clonedDir) {
-                // The caller promised deps.copyDirMirror copies `input.dir` into
-                // `clonedDir`, skipping `.git/`. cloneAndStackPush will `git add --all`
-                // after this returns.
-                await deps.copyDirMirror(input.dir, clonedDir);
-            },
-        });
-        if (unpinned && !input.noPinWrite) {
-            try {
-                await writeWorkspaceSlug(input.dir, backend.workspaceSlug);
-                log(`Wrote workspace = "${backend.workspaceSlug}" into quonfig.json`);
-            }
-            catch {
-                // non-fatal
-            }
+const toServerKind = (kind) => {
+    switch (kind) {
+        case 'added': {
+            return 'add';
         }
-        return { kind: 'pushed', dispatchedAs: 'bare-path', commitSha: result.commitSha };
-    }
-    catch (error) {
-        const msg = error instanceof Error ? error.message : String(error);
-        if (/non-fast-forward|fetch first|rejected/i.test(msg)) {
-            throw new PushFatalError('Remote has changes not in local — run `qfg pull` first, then re-run `qfg push`.', 'NON_FAST_FORWARD');
+        case 'deleted': {
+            return 'delete';
         }
-        throw new PushFatalError(`Push failed: ${msg}`, 'PUSH_FAILED');
-    }
-    finally {
-        // Best-effort cleanup of the scratch clone. Ignore failures so a cleanup
-        // problem doesn't mask a real error.
-        try {
-            fs.rmSync(scratchDir, { recursive: true, force: true });
-        }
-        catch {
-            /* ignore */
+        case 'modified': {
+            return 'modify';
         }
     }
-}
+};
 /**
  * Map the guard outputs to the right prompt:
  *   - Typed-slug (always, never skipped by --yes) when identity demanded it

package/dist/util/gitea-token-storage.js

@@ -1,9 +1,9 @@
 import * as fs from 'node:fs';
-import * as os from 'node:os';
 import * as path from 'node:path';
 import { getDomain } from './domain-urls.js';
+import { getQuonfigConfigHome } from './quonfig-home.js';
 const BUFFER_MS = 5 * 60 * 1000; // 5 minutes
-const getQuonfigDir = () => path.join(os.homedir(), '.quonfig');
+const getQuonfigDir = () => getQuonfigConfigHome();
 const getGiteaTokenFile = () => {
     const domain = getDomain();
     const filename = domain === 'quonfig.com' ? 'gitea-tokens.json' : `gitea-tokens-${domain.replaceAll('.', '-')}.json`;

package/dist/util/quonfig-home.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Resolve the directory the CLI uses for tokens, profile config, and gitea
+ * tokens. Honors `QUONFIG_CONFIG_HOME` so tests (and anyone who wants an
+ * isolated config dir) can redirect away from `~/.quonfig/`.
+ */
+export declare const getQuonfigConfigHome: () => string;

package/dist/util/quonfig-home.js

@@ -0,0 +1,8 @@
+import * as os from 'node:os';
+import * as path from 'node:path';
+/**
+ * Resolve the directory the CLI uses for tokens, profile config, and gitea
+ * tokens. Honors `QUONFIG_CONFIG_HOME` so tests (and anyone who wants an
+ * isolated config dir) can redirect away from `~/.quonfig/`.
+ */
+export const getQuonfigConfigHome = () => process.env.QUONFIG_CONFIG_HOME || path.join(os.homedir(), '.quonfig');

package/dist/util/token-storage.js

@@ -1,8 +1,8 @@
 import * as fs from 'node:fs';
-import * as os from 'node:os';
 import * as path from 'node:path';
 import { getDomain } from './domain-urls.js';
-const getQuonfigDir = (options) => options?.quonfigDir || path.join(os.homedir(), '.quonfig');
+import { getQuonfigConfigHome } from './quonfig-home.js';
+const getQuonfigDir = (options) => options?.quonfigDir || getQuonfigConfigHome();
 const getTokenFile = (options) => {
     const domain = getDomain();
     const filename = domain === 'quonfig.com' ? 'tokens.json' : `tokens-${domain.replaceAll('.', '-')}.json`;

package/dist/verify/validate.js

@@ -118,6 +118,7 @@ const VariantSchema = z.object({
     value: ValueSchema,
     description: z.string().optional(),
 });
+const AccessSchema = z.enum(['support', 'standard', 'protected-env', 'protected-all-envs']);
 const StoredConfigSchema = z
     .object({
     id: z.string().optional(),
@@ -129,8 +130,7 @@ const StoredConfigSchema = z
     description: z.string().optional(),
     sendToClientSdk: z.boolean().optional(),
     schemaKey: z.string().optional(),
-    accessLevel: z.string().optional(),
-    protection: z.string().optional(),
+    access: AccessSchema.optional(),
     default: z.object({
         rules: z.array(ConfigRuleSchema),
     }),

package/oclif.manifest.json

@@ -2983,5 +2983,5 @@
       ]
     }
   },
-  "version": "0.0.22"
+  "version": "0.0.23"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@4.11.0+sha512.4e54aeace9141df2f0177c266b05ec50dc044638157dae128c471ba65994ac802122d7ab35bcd9e81641228b7dcf24867d28e750e0bcae8a05277d600008ad54",
   "name": "@quonfig/cli",
-  "version": "0.0.22",
+  "version": "0.0.23",
   "bugs": {
     "url": "https://github.com/quonfig/cli/issues"
   },